Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,366,295
Community Members
 
Community Events
168
Community Groups

After trying to get SAML single sign-on to work with Azure AD I can't login anymore

I was trying to configure Azure AD and Atlassian cloud for SAML single sign-on and I thought it configured correctly. But I may have configured two tenants.

When I try to login as an Atlassian administrator I get the following error:

Request Id: daa2afe1-b25c-458f-8def-de39110a0300

Correlation Id: 534761d7-b271-4245-b857-a2fcdfda7877

Timestamp: 2020-04-07T00:25:32Z

Message: AADSTS700016: Application with identifier 'https://auth.atlassian.com/saml/ceffa91e-a55e-4ab4-b185-60119714b336' was not found in the directory 'c8a43e29-f09d-477a-8567-335b11f6596a'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

I can't login to Support to request help, so I'm hoping a support person in the community will help me out. I need to get this resolved as soon as possible since none of our users can login.

Thanks!

7 answers

1 accepted

0 votes
Answer accepted
Dave Meyer Atlassian Team Apr 07, 2020

Hi @Tom Horton ,

Please contact Atlassian support directly, we can help get SSO disabled temporarily while we help you diagnose what went wrong. https://support.atlassian.com/contact/#/

I can't submit a tech support request because I can't log into the portal to create one. I called the California office and left a voicemail for tech support an hour ago, but no call back yet. Is there a more direct way to get support in disabling SSO? 

Dave Meyer Atlassian Team Apr 07, 2020

You should be able to use the account that you're currently using for Atlassian Community to create a request, we should be able to get the request associated with your existing account.

My loginID for the Atlassian Community is the same email address that is used for my company's Atlassian account. So when I click on https://support.atlassian.com/contact/#/ I'm prompted for my email address and I get the SSO error and can't login to create a request.

Is there another way to submit a support request using my Atlassian Community account?

Daniel Eads Atlassian Team Apr 07, 2020

Hi Tom,

We've opened a request for you directly - you should have received an email just a moment ago with the case details. Although it seems that you're not able to log in currently due to the SAML misconfiguration, you should be able to interact with the support request over email.

Thanks
Daniel | Atlassian Support

Like Tom Horton likes this

Hello,

 

I just encountered the same issue as Tom above.

 

 

Request Id: f754459e-6c9d-43b7-8bd7-2b10c13d2300
Correlation Id: d3d5e7f5-b151-4fb7-985c-debe7fea9dfe
Timestamp: 2020-04-23T15:56:14Z
Message: AADSTS700016: Application with identifier 'https://auth.atlassian.com/saml/f2cf43c8-d0ef-4426-a112-ab3664221dc6' was not found in the directory 'b063e3ea-b036-4592-8de4-67f7b977b037'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

 

Could you give me a hint how to proceed?

 

Thanks!

 

Peter

Daniel Eads Atlassian Team Apr 28, 2020

Hey Peter,

I can see you've opened a case in our support system as well - thanks! For this type of error, our internal support team is best suited to assist as they ensure the right accounts have administrator access in your Cloud site to make the appropriate SAML changes. They'll have you sorted soon!

Cheers,
Daniel

Same here, answer was to take the tenant id that appears in the login error, append it to https://auth.atlassian.com/saml/<<tenant id>> and put that in the Basic SAML Configuration \ Identifier (Entity ID) field.  And for the 'Reply URL', to append it to https://auth.atlassian.com/login/callback?connection=saml/<<tenant id>>

Thank you, this worked and saved my night!

The main advice I can give on how to avoid this error is to make sure you add an administrator account to JIRA that is from a different domain BEFORE you make any changes to enable single sign-on. The JIRA documentation mentions this, but it's not very prominent. 

I didn't, so when I mistakenly added another tenant and locked myself out, I couldn't log in and remove the bad tenant to restore my access.

To make it even worse, I couldn't submit a support ticket online because I couldn't log in to my Atlassian account to submit it. I had to call the support number and leave a voicemail.

Lesson learned.

Thanks Tom!

Much appreciated. I have the same issue. I'll contact their support teams and see how I go :)

I have also ran into this issue and have opened a support ticket under my personal account. Need to get SSO disabled. Any chance this can be escalated?

Daniel Eads Atlassian Team Jan 31, 2022

Hi @Chad Barczuk , welcome to the Community! 

It looks like the support case you opened was already at a high priority. I'm glad that the support team was able to get you back in to your account quickly!

Cheers,
Daniel

oh dear...

I've also landed with this problem with our corporate account.

Support ticket raised via my personal Atlassian account, fingers cross the support team can turn off SSO so I can get back in a resolved the underlying problem - other than my inability to follow instructions....

Daniel Eads Atlassian Team Jan 25, 2022

Hi @John Heap , welcome to the Community and thanks for the note. I've increased the priority on your support case based on your note that you're currently locked out. Our support team should be in touch shortly.

Ok - so I have to ended up in this loop!  I cannot log a ticket as cannot sign in but do have access here.

 

How do I proceed?

I had to call the closest Atlassian office and leave a voicemail message with their support department. Here is the list of phone numbers, at the bottom of the webpage:

https://www.atlassian.com/company/contact

Managed to identify the issue in that somehow the incorrect entity ID had been populated in Azure, despite using the automated process... odd

 

All working now

Hi All, 

Came accross the same issue on another cloudsite I've configured. Is there a KB article I can follow?

 

Thanks in advance. 

Hi,

 

I directly contacted the Atlassian Cloud support.

The first step to obtain access again is to add a new User with from another Domain to your Atlassian cloud system. With the new user it is possible to fix the settings.
(At which step I'm right now)
I'm not quiet sure if this can be done on yourself.

Here I'd also recommend to go directly for the Atlassian Cloud Support.

 

BR

 Peter

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events